feat(ci): emit release-manifest fragment artifact (H3)

.gitea/workflows/build-image.yml

@@ -38,3 +38,14 @@ jobs:
         run: |
           echo "${REGISTRY_PASSWORD}" | docker login "${REGISTRY}" -u "${REGISTRY_USER}" --password-stdin
           docker push ${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}
+
+      - name: Emit release fragment
+        run: |
+          FRAG_REPO=sow-tools \
+          FRAG_SHA=${{ steps.tag.outputs.sha }} \
+          FRAG_ARTIFACT="${REGISTRY}/${IMAGE}:${{ steps.tag.outputs.sha }}" \
+          FRAG_URL="${REGISTRY}/${IMAGE}" \
+          FRAG_RUN_ID=${{ gitea.run_id }} \
+          ./scripts/emit-release-fragment.sh
+      - uses: actions/upload-artifact@v3
+        with: { name: release-fragment, path: release-fragment.json }

scripts/emit-release-fragment.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Emit a release-manifest fragment describing the artifact this CI run produced.
+# Provenance only - it never blocks. sow-platform's promotion (D24) consumes it.
+#
+# Env (all optional except REPO + SHA):
+#   FRAG_REPO     repo name (e.g. sow-codebase)         [required]
+#   FRAG_SHA      git sha of the build                  [required]
+#   FRAG_ARTIFACT artifact name (image ref or filename) [required]
+#   FRAG_FILE     path to a built file to checksum       (optional)
+#   FRAG_DIGEST   image digest if known                  (optional)
+#   FRAG_URL      publish URL                            (optional)
+#   FRAG_RUN_ID   CI run id                              (optional)
+#   FRAG_OUT      output path (default release-fragment.json)
+set -euo pipefail
+: "${FRAG_REPO:?set FRAG_REPO}"; : "${FRAG_SHA:?set FRAG_SHA}"; : "${FRAG_ARTIFACT:?set FRAG_ARTIFACT}"
+out="${FRAG_OUT:-release-fragment.json}"
+
+checksum=""
+if [[ -n "${FRAG_FILE:-}" && -f "${FRAG_FILE}" ]]; then
+  checksum="$(sha256sum "$FRAG_FILE" | cut -d' ' -f1)"
+fi
+
+cat > "$out" <<JSON
+{
+  "repo": "$FRAG_REPO",
+  "sha": "$FRAG_SHA",
+  "artifact": "$FRAG_ARTIFACT",
+  "digest": "${FRAG_DIGEST:-}",
+  "sha256": "$checksum",
+  "publish_url": "${FRAG_URL:-}",
+  "run_id": "${FRAG_RUN_ID:-}"
+}
+JSON
+echo "emit-release-fragment: wrote $out"